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[57] ABSTRACT 

A storage device, having the function of coping with a 
computer virus which has the ability to prevent infection 
with a computer virus and properly deal with infection with 
a computer virus, comprises: an infection management table 
used to manage files stored on a disk to see if the files are 
infected with viruses; a table registering unit for receiving a 
result of detection from a virus checker for detecting if a file 
stored on a disk is infected with a virus, and for registering 
the result in the infection management table; a judging unit 
that when a use request is made externally for a file stored 
on the disk, references the infection management table so as 
to judge if the file is infected with a virus; and a prohibiting 
unit that when the judging unit judges that a file is infected 
with a virus, prohibits the use of the file. 
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STORAGE DEVICE HAVING FUNCTION a virus. If any of the files is infected, the file is treated 

FOR COPING WITH COMPUTER VIRUS properly. The prior art does not adopt a method of actively 

preventing infection with a virus. There is therefore a 

BACKGROUND OF THE INVENTION problcm tha{ mcs cxpa nded on the disk in the storage device 

1. Field of the Invention 5 are readil y infected with a virus. 

The present invention relates to a storage device having a Moreover, in the prior art, when it is detected that any of 

function for coping with a computer virus that has the ability files expanded on a disk in a storage device is infected with 

to prevent infection with a computer virus and to properly a virus > me files expanded on the disk are cleared and then 

deal with infection with a computer virus. originals of the files are installed again. This poses a problem 

In recent years, computer systems using computer pro- 10 that a ™* is * incur an enormous work load, 

grams have prevailed in enterprises, households, and the In the prior art, a file judged to be infected with a virus is 

like. Accordingly, the number of occurrences of computer cleared in its entirety. It cannot be analyzed as to what kind 

viruses that destroy or damage the computer systems and °f virus destroyed the file. This poses a problem in that an 

that have an auto-proliferation ability has tended to increase J5 anti-virus measure cannot be examined, 
markedly. 

In particular, recently-procurable personal computers are 

interconnected over a network such as a local area network In view of the above-described problems, an object of the 

(LAN) and adopt the configuration enabling information present invention is to provide a storage device having a 

exchange through data communications. The fear that a 20 function, for coping with a computer virus which has the 

computer virus (hereinafter abbreviated to a vims) residing ability to prevent infection with a virus and to properly deal 

in one personal computer spreads into the other personal with an infection of a virus. 

computers connected over the network is becoming more To solve the abovc pro blems, a storage device having a 

and more serious. function for coping with a computer virus in accordance 

This makes it necessary to construct a storage device 2 5 with the present invention comprises: an infection manage- 

having the ability to freely use files while preventing the men t table means used to manage files stored on a disk and 

breeding of a virus and to delete a file infected with a virus to see if the files are infected with a virus; a table registering 

or restore the infected file into an uninfected state. means for receiving a result of detection from a virus 

2. Description of the Related Art checker for detecting if a file stored on the disk is infected 
For a clear understanding of problems concerning viruses 30 with a virus, and for registering the result in the infection 

destroying computer systems, infection with a virus in a management table means; a judging means that when a use 

typical storage device will be described with reference to request is made externally for a file stored on the disk, 

FIG. 1. references the infection management table means so as to 

A storage device 100 basically comprises, as shown in i ud S c if the filc is infected with a virus; and a prohibiting 

FIG. 1, a disk 105 for storing files, and a controller 120 for 35 means that when the J ud g in g means has j ud g ed tnat a file * s 

executing driving control for the disk 105 and also executing infected with a virus, prohibits the use of the file, 

input/output control for a personal computer 110 that is In the storage device having the function of coping with 

connected to the drive. a computer virus in accordance with the present invention, 

The storage device 100 having the foregoing components preferably, the virus checker is designed to be run by the 

is designed to be directly accessed by a driver under the 40 storage device having a function for coping with a computer 

control of an operating system in the personal computer 110 virus. 

comprising a CPU 112 for processing various kinds of data, Furthermore, in the storage device having the function of 

a RAM 114 for storing various kinds of data and programs, coping with a computer virus in accordance with the present 

a ROM 116, and the like. In other words, the storage device invention, the virus checker is designed to be activated at 

yields such an environment in which; a file expanded in the 45 intervals of a specific cycle. 

personal computer 110, one running can readily destroy More preferably, in the storage device having the function 

other files stored in the storage device. of coping with a computer virus in accordance with the 

On the other hand, a virus that intrudes from an external present invention, the virus checker is designed to be acti- 

unit into a file via a LAN adapter 130, keyboard 140, display 5Q vated in response to a command instruction. 

150, or the like rewrites another file using a physical address More preferably, in the storage device having ihe function 

of the file which is indicated by low-order address bits, or of coping with a computer virus in accordance with the 

rewrites a system startup area such as a bootstrap using a present invention, when a writing request is issued for a 

physical address of the system startup area which is indi- system startup area stored on a disk, the table registering 

cated by low-order address bits, and thus destroys an origi- 55 means judges that a file which is stored on the disk and is a 

nal program. source of the writing request is infected with a vims and that 

This poses a problem that files stored in a storage device registers the fact in the infection management table means, 

are readily infected with a vims. More preferably, the storage device having the function of 

In an effort to cope with the above problem, a prior art coping with a computer virus in accordance with the present 

system design is adopted such that if a virus checker (not 60 invention includes an invalidating means that when a writing 

shown) expanded in the personal computer 110 finds a file request is issued for the system startup area stored on the 

infected with a virus from among files expanded on the disk disk, invalidates the writing request. 

105 in the storage device 100, all the files expanded on the More preferably, the storage device having the function of 

disk are cleared and then originals of the files are installed coping with a computer virus in accordance with the present 

again- 65 invention includes a dedicated writing means for executing 

However, in the prior art, it is detected whether any of the writing for the system startup area stored on the disk. When 

files expanded on a disk in a storage device is infected with a writing request is issued for the system startup area stored 
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on the disk, if the writing request specifies the use of the fication which is confirmed not to be infected with a virus by 

writing means, the invalidating means does not invalidate the virus checker. 

the writing request. More preferably, in the storage device having the function 

More preferably, in the storage device having the function of coping with a computer virus in accordance with the 

of coping with a computer virus in accordance with the s present invention, as for a file which is stored on the disk, of 

present invention, when a writing request is issued for an which original information is not registered in the first 

executable file stored on a disk, the table registering means managing means, and of which differential information 

judges that a file which is stored on the disk and is a source brought about due to modification is not registered in the 

of the writing request is infected with a virus and registers second managing means, the table registering means judges 

the fact in the infection management table means. 1° that the file stored on the disk is infected with a virus, and 

More preferably, the storage device having the function of then registers the fact in the infection management table 

coping with a computer virus in accordance with the present means. 

invention includes a permitting means for determining More preferably, the storage device having the function of 
whether a writing request made for a file that is registered as coping with a computer virus in accordance with the present 
a virus-infected file by the table registering means and that 15 invention includes a restoring means for deleting a virus- 
is running should be permitted. infected file that is registered in the infection management 
More preferably, in the storage device having the function table means from the disk, activating the file registering 
of coping with a computer virus in accordance with the means, thus restoring the file, and then registering the file on 
present invention, when a writing request is permitted by the the disk. 

permitting means, if a file that is a destination of the writing More preferably, in the storage device having the function 
request is rewritten, the table registering means judges that of coping with a computer virus in accordance with the 
the file which is the destination of the writing request is also present invention, the first managing means manages origi- 
infected with a virus and registers the fact in the infection nal information of the virus checker, and the second man- 
management table means. aging means manages differential information brought about 
More preferably, in the storage device having the function due t0 modification concerning the virus checker and history 
of coping with a computer virus in accordance with the information concerning the differential information brought 
present invention, when the size of a file is varied by running about due t0 modification. The storage device includes a 
the file, the table registering means judges that the file stored generating means for merging the original information of a 
on the disk is infected with a virus and registers the fact in 3Q virus checker which is managed by the first managing means 
the infection management table means. with the differential information brought about due to modi- 
More particularly, in the storage device having the func- fication concerning a virus checker which is managed by the 
tion of coping with a computer virus in accordance with the sccond managing means so as to reproduce the virus 
present invention, although a file stored on the disk is judged checker. 

to be an executable file in terms of the file name, if the file 35 More preferably, in the storage device having the function 

is declared to be a data file, the table registering means of coping with a computer virus in accordance with the 

judges that the file stored on the disk is infected with a virus present invention, the generating means generates a virus 

and registers the fact in the infection management table checker at the time of running a virus checker, 

means. More preferably, in the storage device having the function 

More preferably, the storage device having the function of 40 of coping with a computer virus in accordance with the 

coping with a computer virus in accordance with the present present invention, the first managing means encodes and 

invention includes a determining means for determining manages original information, and the second managing 

through interactive processing whether the use of a virus- means encodes and manages differential information 

infected file that is registered in the infection management brought about due to modification. The storage device 

table means should be permitted. The prohibiting means 45 includes a decoding means for decoding encoded data 

does not prohibit the use of a file which is permitted by the managed by the first and second managing means, and an 

determining means. encoding means for executing inverse conversion that is 

More preferably, the storage device having the function of inverse to conversion performed by the decoding means, 
coping with a computer virus in accordance with the present More preferably, the storage device having the function of 
invention includes: a first managing means for managing 50 coping with a computer virus in accordance with the present 
original information of files stored on a disk; a second invention includes a saving means for saving a virus- 
managing means for managing differential information infected file that is registered in the infection management 
brought about due to modification concerning the files stored table means and virus information concerning the file in an 
on a disk, and history information concerning the differential inexecutable area, and a reading means for reading the 
information brought about due to modification; and a file 55 information saved in the inexecutable area under the con- 
registering means for merging the original information of a dition that permission information for permitting access to 
file which is managed by the first managing means and the the inexecutable area is given. 

differential information brought about due to modification In the storage device having the function of coping with 

which is managed by the second managing means so as to a computer virus in accordance with the present invention, 

produce a file, and then registering the produced file on the 60 the table registering means registers a virus-infected file 

disk. detected by the virus checker in the infection management 

More preferably, in the storage device having the function table means, 

of coping with a computer virus in accordance with the Furthermore, when a writing request is issued for a system 

present invention, the first managing means manages origi- startup area stored on a disk, since a normal file will not 

nal information that is confirmed not to be infected with a 65 issue such a writing request, the table registering means 

virus by the virus checker, and the second managing means judges that a file which is a source of the writing request is 

manages differential information brought about due to modi- infected with a virus, and registers the fact in the infection 
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management table means. This is intended to treat new, BRIEF DESCRIPTION OF THE DRAWINGS 

malign, or unusual kinds of viruses Uiat cannot be detected The aboye ob - c|s ^ foatures of ^ nt mvention 

by the virus checker. At this time, when a wntmg request is ^ be mQre em from ^ followin descriplion of 

', wt v 8 meaDS mVaI 1 ld , at " S * e Wn .? n8 some preferred embodiments with reference to the accom- 

request. When the writing means is included, if the writing c . r , , 

request specifies the use of the writing means, the invali- P^g drawings, wherein: 

dating means does not invalidate the writing request. F IG - 1 (PRIOR ART) is a block diagram showing the 

Moreover, when a writing request is issued for an execut- configuration of a typical storage device; 

able file stored on a disk, since a normal file will not issue FIG. 2 is a block diagram showing the configuration of an 

such a writing request, the table registering means judges 30 embodiment based on the basic principles of the present 

that a file which is a source of the writing request is infected invention; 

with a virus and registers the fact in the infection manage- piQ. 3 is a block diagram showing the configuration of the 

mem table means. The permitting means determines through firsl pre f e rred embodiment of the present invention; 

interacuve processing whether the writing request should be 6[ showi detai 

permitted. When the permitting means permits the writing t . . . % & 

request, since the file is rewritten, the table registering 15 ^executable area in FIG. 3; 

means judges that the file which is stored on the disk and is FIG. 5 is a block diagram showing the configuration of the 

a destination of the writing request is also infected with the second preferred embodiment of the present invention; 

virus and registers the fact in the infection management table FIG. 6 is a block diagram showing the configuration of the 

means. third preferred embodiment of the present invention; 

When the size of a file is varied by running the file, the 20 FIG. 7 is a block diagram showing the configuration of the 

table registering means judges that the file stored on the disk fourth preferred embodiment of the present invention; 

is infected with a virus and registers the fact in the infection FIG. 8 is a block diagram showing the configuration of the 

management table means. fifth preferred embodiment of the present invention; 

Although a file stored on a disk is judged to be an FIG. 9 is a block diagram showing the configuration of the 

executable file in terms of the file name, if the file is declared sixth preferred embodiment of the present invention; 

to be a data file, the table registering means judges that the fig. 10 is a block diagram for explaining a procedure of 

file stored on the disk is infected with a virus and registers fii c production in accordance with the present invention; 

the fact in the infection management table means. p IG n is a bloc fc diagram for explaining a procedure of 

As for a file which is stored on a disk, of which original 3Q fife storage in accordance with the present invention; 
information is not registered in the first managing means, piG. 12 is a block diagram showing the details of a 
and of which differential information brought about due to conversion table in a ROM in accordance with the present 
modification is not registered in the second managing invention- 
means, the table registering means judges that the file stored FKJ ^ ^ a block diagram showing an example of a data 
on the disk is infected with a virus and registers the fact m 3S structure for a file information management file in accor- 
the infection management table means. dance ^ the prcseQt inverition; 

As mentioned above, when a virus-infected file is regis- piG. 14 is a flowchart for explaining the first example of 

tered in the infection management table means, if a data a processing flow t0 be executed by an embodiment of the 

processing unit makes a use request for the file stored on the present invention* 

disk, the judging means references the infection manage- 40 nG lg ^ & for kini me second , e 

ment table means so as to judge if the file for which the use of essi flow t0 be execuled 5y an embod i men t of the 

request is made is infected with a virus. On receipt of a result res ent invention* 

of the judgment, the prohibiting means prohibits the use of p ° * ' . , , 

fi . J . u * • -\ A f > • r 7 . , f • 1C , Ai (W f < FIG. 16 is a flowchart for explaining the third example of 

the file that is judged to be infected with a virus. At this time, _ - . ,< i_ j- , 

*u u-u-4- , . „„ r „ a processmg flow to be executed by an embodiment or the 

the prohibiting means does not prohibit the use 01 a rile 45 * * • 

which is permitted by the determining means. P re ff° l petition; 

rp* . tU . ■ c , ra „ . rtPfl 0 FIG. 17 is a flowchart for explaining the fourth example 

The saving means saves, that is, stores temporarily a _ . a . : JL LJ * . r !l 

• r * a a\ t, • rt i,-U f 1- a of a processing flow to be executed by an embodiment 01 the 

virus-infected file whose use is prohibited and virus inror- * ■ ? 

mation concerning the file in the inexecutable area. The P rese ° l *" venll0 a a; t c ..... L 

reading means reads the saved information from the inex- 50 f HG ' 18 15 a f 0Wd T for ex P l j aima 8 the !°™ th exam P L le 

ecutable area and outputs it as information used for virus of a Pressing flow to be executed by an embodiment of the 

analysis under the condition that permission information for present invention; 

permitting access to the inexecutable area is given. FIG. 19 is a flowchart for explaining the fifth example of 

On the other hand, the restoring means deletes a virus- a processing flow to be executed by an embodiment of the 

infected file, which is registered in the infection manage- 55 P resem invention; 

ment table means, from the disk, activates the file registering FIG. 20 is a flowchart for explaining the sixth example of 

means, thus restores the file, and then registers the restored * processing flow to be executed by an embodiment of the 

file on a disk. present invention; 

As mentioned above, the storage device having the func- FIG. 21 is a flowchart for explaining the seventh example 

tion of coping with a computer virus in accordance with the 60 of a processing flow to be executed by an embodiment of the 

present invention is designed to actively prevent infection present invention; 

with a virus, prohibits the use of a virus-infected file and FIG. 22 is a flowchart for explaining the eighth example 

restores the virus-infected file automatically, and preserves of a processing flow to be executed by an embodiment of the 

information concerning infection with viruses so that the present invention; 

information cannot be accessed readily. Consequently, a 65 FIG. 23 is a flowchart for explaining the ninth example of 

storage device capable of properly dealing with infection a processing flow to be executed by an embodiment of the 

with a virus can be constructed. present invention; 
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FIG. 24 is a block diagram for explaining the first information from being rewritten. At this time, a decoding 

example of an anti-virus operation in the embodiment shown means for decoding the encoded data and an encoding 

in FIG. 2; means for executing inverse conversion that is inverse to 

FIG. 25 is a block diagram for explaining the second conversion performed by the decoding means are included 

example of the anti-virus operation in the embodiment 5 in foe second managing means 12. 

shown in FIG. 2; The file registering means 13 merges the original infor- 

FIG. 26 is a block diagram for explaining the third mation of a file which is managed by the first managing 

example of the anti-virus operation in the embodiment means U with the difTerential information brought about due 

shown in FIG. 2* t0 modification concerning the file which is managed by the 

FIG. 27 is'a block diagram for explaining the fourth 10 second managing means 12 ^ as to reproduce the file, and 

example of the anti-virus operation in the embodiment men stores me file on the disk 10. The generatmg means 14 

shown in FIG 2' merges the original information of the virus checker 15 

. ' , ,. - , „- , which is managed by the first managing means 11 with the 

FIG 28 is a block diagram for explaining the fifth differential information brought about due to modification 

example of the anti-virus operaUon in the embodunent :5 concerning me virus checker 15 which is managed by the 

snown m riu. z, second managing means 12 so as to reproduce the virus 

FIG. 29 is a block diagram for explaining the sixth checker 15. 

example of the anti-virus operation in the embodiment The yirus checkef 15 ^ activated at intervals of a specific 

shown in Flo. Z, and period or activated in response to a command instruction, 

FIG. 30 is a block diagram for explaining the seventh ™ and detecls wneme r a file stored on the disk 10 is infected 

example of the anti-virus operation in the embodiment ^ a viruSt ^ infection management table means 16 is 

shown in FIG. 2. usec j to mana g e files stored on the disk and to see if the files 

DESCRIPTION OF THE PREFERRED are infected with viruses. The table registering means 17 

EXinnnniCMTc registers data in the infection management table means 16. 

EMBODIMENTS 2 5 nf • A • 10 e *u • c ** 

The judging means 18 references the infection management 

Hereinafter, the description of some preferred embodi- table means 16 in response to a use request made for a file 

ments according to the present invention will be given with stored on the disk 10 by the data processing unit 2, and 

reference to the accompanying drawings. judges if the file is infected with a virus. When the judging 

FIG. 2 is a block diagram showing the configuration of an means 18 judges that a file is infected with a virus, the 

embodiment based on the basic principles of the present 30 prohibiting means 19 prohibits the use of the file, 

invention. The determining means 20 determines through interactive 

In the drawing, reference numeral 1 denotes a storage processing whether the use of a file registered in the infec- 

device having the function of coping with a computer virus tion management table means 16 should be permitted. The 

in accordance with the present invention. Reference numeral 35 restoring meaas 21 deletes a virus-infected file, which is 

2 denotes a data processing unit for executing data process- registered in the infection management table means 16, from 

ing using a file stored in the storage device 1 having the the disk 10, activates the file registering means 13, thus 

function of coping with a computer virus. restores the file, and then registers the restored file on the 

The storage device 1 having the function of coping with disk 10. When a writing request is issued for a system startup 

a computer virus comprises a disk 10, first managing means 40 area stored on the disk 10, the invalidating means 22 

11, second managing means 12, file registering means 13, invalidates the writing request. The writing means 23 is 

generating means 14, virus checker 15, infection manage- prepared as a dedicated writing facility and executes writing 

ment table means 16, table registering means 17, judging for me system startup area stored on the disk 10. 

means 18, prohibiting means 19, determining means 20, The permitting means 24 determines through interactive 

restoring means 21, invalidating means 22, writing means 45 processing whether a writing request made for an executable 

23, permitting means 24, inexecutable area 25, saving means file stored on the disk should be permitted. The inexecutable 

26, and reading means 27. Herein, the virus checker 15 may area 25 is prepared as an area inaccessible with a normal 

be expanded in the data processing unit 2. access request. The saving means 26 saves a virus-infected 

The disk 10 stores files. The first managing means 11 file registered in the infection management table means 16 

manages original information of the files stored on the disk 50 and virus information concerning the file in the inexecutable 

10 or manages original information of the virus checker 15. area 25 - ^ reading means 27 reads information saved in 

The second managing means 12 manages differential infor- mc inexecutable area 25 under the condition that permission 

mation brought about due to modification; that is, informa- information for permitting access to the inexecutable area 25 

tion concerning upgraded versions of the files stored on the 15 given. 

disk, and history information concerning the differential 55 In the embodiment of the present invention shown in FIG. 
information brought about due to modification, or manages 2, the table registering means 17 registers a virus-infected 
differential information brought about due to modification file detected by the virus checker 15 in the infection man- 
concerning the virus checker 15; that is, information con- agement table means 16. 

cerning an upgraded version of the virus checker 15, and Furthermore, when a writing request is issued for a system 

history information concerning the differential information 60 startup area stored on the disk 10, since a normal file will not 

brought about due to modification. issue such a writing request, the table registering means 17 

The first managing means 11 may encode and manage the judges that a file which is stored on the disk 10 and is a 

original information of the files and virus checker 15 so as source of the writing request is infected with a virus, and 

to prevent the original information from being rewritten. The registers the fact in the infection management table means 

second managing means 12 may encode and manage the 65 16. This is intended to treat new, malign, or unusual kinds of 

differential information brought about due to modification viruses that cannot be detected by the virus checker 15. 

concerning the files and virus checker 15 so as to prevent the When the writing request is issued, the invalidating means 
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22 invalidates the writing request. However, when the 
writing means 23 is included, if the writing request specifies 
the use of the writing means 23, the invalidating means 23 
does not invalidate the writing request. 

When a writing request is issued for an executable file 
stored on the disk 10, since a normal file will not issue such 
a writing request, the table registering means 17 judges that 
a file which is stored on the disk 10 and is a source of the 
writing request is infected with a virus, and registers the fact 
in the infection management table means 16. At this time, 
the permitting means 24 determines through interactive 
processing whether the writing request should be permitted. 
When the permitting means 24 permits the writing request, 
since the file is rewritten, the table registering means 17 
judges that a file which is stored on the disk 10 and is a 
destination of the writing request is also infected with the 
virus, and registers the fact in the infection management 
table means 16. 

Moreover, when the size of a file is varied by running the 
file, the table registering means 17 judges that the file stored 
on the disk 10 is infected with a virus, and registers the fact 
in the infection management table means 16. 

Moreover, although a file stored on the disk is judged as 
an executable file in terms of the file name, if the file is 
declared to be a data file, the table registering means 17 
judges that the file stored on the disk 10 is infected with a 
virus, and registers the fact in the infection management 
table means 16. 

Moreover, as for a file which is stored on the disk 10, of 
which original information is not registered in the first 
managing means 11, and of which differential information 
brought about due to modification is not registered in the 
second managing means 12, the table registering means 17 
judges that the file stored on the disk 10 is infected with a 
virus, and registers the fact in the infection management 
table means 16. 

As mentioned above, when a virus-infected file is regis- 
tered in the infection management table means 16, if the data 
processing unit 2 makes a use request for the file stored on 
the disk 10, the judging means 18 references the infection 
management table means 16 so as to judge if the file for 
which the use request is made is infected with a virus. On 
receipt of a result of the judgment, the prohibiting means 19 
prohibits the use of the file that is judged to be infected with 
a virus by the judging means 18. At this time, the prohibiting 
means 19 does not prohibit the use of a file which is 
permitted by the determining means 20. 

The saving means 26 saves the virus-infected file whose 
use is prohibited and virus information concerning the file in 
the inexecutable area 25 that cannot be accessed readily. The 
reading means 27 reads the saved information from the 
inexecutable area 25 under the condition that permission 
information for permitting access to the inexecutable area 25 
is given, and outputs the read information as information 
used for virus analysis. 

On the other hand, the restoring means 21 deletes a 
virus-infected file registered in the infection management 
table means 16 from the disk 10, activates the file registering 
means 13, thus restores the file, and registers the file on the 
disk 10. 

As mentioned above, the storage device 1 having the 
function of coping with a computer virus shown in FIG, 2 is 
designed to actively prohibit infection with a virus, to 
prohibit the use of a file infected with a virus and restores the 
file automatically, and to preserve information concerning 
infection with viruses so that the information cannot be 
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accessed readily. Thus, a storage device capable of properly 
dealing with infection with a virus can be constructed. 

A storage device having the function of coping with a 
computer virus in accordance with the present invention will 

5 be described below in detail in conjunction with several 
preferred embodiments that are more practical than the basic 
embodiment shown in FIG. 2. 

FIG. 3 shows the first preferred embodiment of the 
storage device 1 having the function of coping with a 

10 computer virus in accordance with the present invention. 
The storage device 1 having the function of coping with 
a computer virus in this embodiment is connected to a 
personal computer 2a. The storage device 1 includes a disk 
30 for storing files that are objects of access obtained by the 
personal computer 2a as well as a ROM 31 for storing 
firmware or the like that executes access processing or 
anti-virus processing, a CPU 32 for running firmware stored 
in the ROM 31 and executing data transfer to or from the 

2Q personal computer 2a, and a RAM 33 prepared as a work 
area used by firmware that is run by the CPU 32, and thus 
has the capability of a CPU. 

The storage device 1 further includes an original infor- 
mation management file 34 used to manage original infor- 

25 mation of files stored on the disk 30 and original information 
of a virus checker prepared for inspection of the files stored 
on the disk. A version update information management file 
35 is used to manage differential information brought about 
due to modification concerning a file stored on the disk 30 

3Q and history information concerning the differential informa- 
tion brought about due to modification, and to manage 
differential information brought about due to modification 
concerning the virus checker and history information con- 
cerning the differential information brought about due to 

35 modification. A file information management file 36 is used 
to manage the information indicating if the files are stored on 
the disk, and is used to determine if the original information 
stored in the original information management file 34, and 
the differential information (brought about due to modifica- 

40 tion and which is stored in the version upgrade information 
management file 35) are infected with viruses. The infor- 
mation indicates if the files to be managed are executable 
files or data files, and if the files to be managed belong to a 
bootstrap or an initial program loader (IPL). An inexecutable 

45 area 37 which is prepared as an area that becomes accessible 
only when a password and ID number agree with internal 
data, and in which a file infected with a virus and virus 
information concerning the file are saved, has a data struc- 
ture shown in FIG. 4. Herein, the reason why the version 

50 update information management file 35 manages history 
information is to make apparent which is the latest differ- 
ential information brought about due to modification. 

The inexecutable area 37 shown in FIG. 4 includes an 
infected-file storage area that is a storage area in which files 

55 infected with viruses are stored, and a virus information 
storage area that is a storage area in which virus information 
of the viruses is stored. Furthermore, the virus information 
storage area contains detailed information; such as, names of 
infected files that are infected with viruses, storage locations 

60 of the infected files, sizes of the storage locations of the 
infected files, sizes of virus information, name of viruses, 
and the information indicating if the viruses are of a system 
area infection type or a file infection type, and the informa- 
tion indicating if the viruses are of a file destruction type or 

65 the like. 

Further included is a controller 38 for accessing a file 
stored on the disk, accessing original information managed 
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in the original information management file 34, accessing 
the differential information brought about due to modifica- 
tion and history information which are managed in the 
version upgrade information management file 35, or access- 
ing information saved in the inexecu table area 37. s 

Herein, the original information management file 34 and 
version upgrade information management file 35 are not 
designed to enable management of original information and 
differential information brought about due to modification 
from the viewpoint of a mere difference but may be designed 10 
to enable management of original information and differen- 
tial information brought about due to modification on the 
basis of a relationship of succession including a parent-child 
relationship. 

In the first preferred embodiment shown in FIG. 3, the 15 
storage device 1 having the function of coping with a 
computer virus is connected to the personal computer 2a. 
Aside from this, like the second preferred embodiment 
shown in FIG. 5, the storage device 1 may be connected over 
a LAN. In the embodiment shown in FIG. 3, the original 20 
information management file 34 and version upgrade infor- 
mation management file 35 are separate files. In the third 
preferred embodiment shown in FIG. 6 and the fourth 
preferred embodiment shown in FIG. 7, the original infor- 
mation management file and version upgrade information 25 
management file may be formed with one file. This kind of 
file is realized in the form of an original information/version 
upgrade information management file 34/35 shown in FIGS. 
6 and 7. In the embodiment shown in FIG. 7, a personal 
computer and a storage device having the function of coping 30 
with a computer virus are united by combining the configu- 
rations shown in FIGS. 5 and 6. The embodiment shown in 
FIG. 3 has the configuration in which the storage device 1 
having the function of coping with a computer virus is 
installed outside the personal computer 2a. Alternatively, 35 
like the fifth preferred embodiment shown in FIG. 8 and the 
sixth preferred embodiment shown in FIG. 9, the storage 
device may be installed inside the personal computer 2a. To 
be more specific, in the embodiment shown in FIG. 8, the 
original information management file 34 and version 40 
upgrade information management file 35 are separate files. 
In the embodiment shown in FIG. 9, both the files are 
formed with one file. 

The storage device 1 having the function of coping with 45 
a computer virus in accordance with the present invention 
has, as mentioned above, the configuration including the 
original information management file 34 and version 
upgrade information management file 35. 

The foregoing configuration is adopted for the following 50 
reasons: original information of a file stored on the disk 30 
is stored in the original information management file 34; 
when the file is upgraded into a new version, differential 
information brought about due to modification concerning 
the upgraded version and history information concerning the 55 
differential information brought about due to modification 
are stored in the version upgrade information management 
file 35; and in case a file stored on the disk 30 is infected 
with a virus, the file can be restored by merging the original 
information of the file with differential information brought 6 q 
about due to modification. Moreover, since original infor- 
mation of a file and differential information brought about 
due to modification concerning the file are not expanded on 
the disk 30, it can be prevented that these kinds of infor- 
mation are infected with a virus. 65 

A virus checker prepared for inspection of a file stored on 
a disk also has the possibility of being upgraded into a new 
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version. The original information of the virus checker is 
stored in the original information management file 34. 
Differential information brought about due to modification 
concerning the upgraded version and history information 
concerning the differential information brought about due to 
modification are stored in the version upgrade information 
management file 35. Thus, the virus checker is managed. 

Incidentally, when the original information management 
file 34 and version upgrade information management file 35 
are constructed on the same medium, original information of 
files and a virus checker, differential information brought 
about due to modification concerning the files and virus 
checker, and history information concerning the differential 
information brought about due to modification can be man- 
aged totally. This is convenient in practice. In addition, the 
disk 30 and inexecutable area 37 may be constructed on the 
medium. 

Original information of files and a virus checker which is 
stored in the original information management file 34, and 
differential information brought about due to modification 
concerning the files and virus checker and history informa- 
tion concerning the differential information brought about 
due to modification which are stored in the version upgrade 
information management file 35 must not be rewritten by the 
personal computer 2a. 

The storage device 1 having the function of coping with 
a computer virus has the configuration in which original 
information 34a of files and a virus checker which is stored 
in the original information management file 34, and differ- 
ential information brought about due to modification con- 
cerning the files and virus checker and history information 
concerning the differential information brought about due to 
modification which are stored in the version upgrade infor- 
mation management file 35 are encoded, and in which a 
decoding mechanism for decoding encoded data is made 
ready. As shown in FIG. 10, the original information of a file 
or virus checker decoded by the decoding mechanism is 
merged with the differential information brought about due 
to modification concerning the file or virus checker which is 
decoded by the decoding mechanism in order to reproduce 
the file or virus checker. Moreover, an encoding mechanism 
for executing inverse conversion that is inverse to conver- 
sion performed by the decoding mechanism is made ready. 
As shown in FIG. 11, the original information of files and a 
virus checker which is encoded by the encoding mechanism 
is stored in the original information management file 34. The 
differential information brought about due to modification 
and history information 35a concerning the files and virus 
checker which are encoded by the encoding mechanism are 
stored in the version upgrade information management file 
35. 

More particularly, the encoding mechanism and decoding 
mechanism are realized by firmware stored in an area 312, 
which is reserved in order to store firmware, in the ROM 31 
in the storage device 1 having the function of coping with a 
computer virus. For realizing the mechanisms, as shown in 
FIG. 12, a conversion table 310 is used to encode original 
information, differential information brought about due to 
modification, and history information, and a conversion 
table 311 is used to decode the original information, differ- 
ential information brought about due to modification, and 
history information which are encoded are stored in the 
ROM 31. 

Furthermore, the storage device 1 having the function of 
coping with a computer virus in accordance with the present 
invention includes the file information management file 36 
as mentioned above. 
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The file information management file 36 manages the storage area and virus information storage area (storage 

information indicating if files stored on the disk 30, original areas shown in FIG. 4) within the inexecutable area 37 (step 

information stored in the original information management S141). Thereafter, initialization is executed by registering an 

file 34, and differential information brought about due to id number and password needed to access the inexecutable 

modification which is stored in the version upgrade infor- 5 area 37 (step S142). 

mation management file 35 are infected with viruses, the * . , P ... . . . . P „ e 

. c P,. f it _ c, 4 . j On the other hand, for registering original information of 

information indicating if these files to be managed are , , nt - ^ . . , ■ f *• 

executable files or data files, and the information indicating * f rchas ^ file » onginal information management file 

that the files to be managed belong to a bootstrap or an IPL. 34 or ^g^ering differential mformation brought about due 

FIG. 13 shows an example of a data structure for the file in t0 edification concerning the file m the version upgrade 

information management file 36. The example shown in 10 information management file 35, the storage device 1 having 

FIG. 13 is devised on the assumption that a file which is the function of coping with a computer virus merges original 

stored on the disk and writes a bootstrap or an IPL is judged information of a virus checker which is stored in the original 

to be infected with a virus, and that a file which is stored on information management file 34 with the latest differential 

the disk and writes an executable file is judged to be infected mformation brought about due to modification concerning 

with a virus. This is attributable to the fact that a normal file 15 the virus checker which is stored in the version upgrade 

will not perform the former writing and will not in general information management file 35. Thus, the virus checker is 

perform the latter writing, either. reproduced and expanded in the RAM 33. 

Specifically, the file information management file 36 As shown in the second example of a processing flow in 

manages, as shown in FIG. 13, file names of files to be FIG. 15, the reproduced virus checker is used to check if a 

managed, addresses of the files, execution/data type flags 20 flu registered (original information and differential infor- 

indicating whether the files are executable files or data files, ma tion brought about due to modification) is infected with 

and starting portion flags indicating if the files belong to a a virus ( step S151 ) If it is j udged that the file is infected with 

bootstrap or an IPL. File information management file 36 a yims? mc infccted fik and y[ms information concerning 

also manages: infection flags <1> indicating if it is detected ^ fi]e are sayed m ^ inexecutable area 37 (st S152) . 

by a virus checker that the files are infected with viruses, 25 Use Prohi5ited Due To Infection With a Virus is reported to 

infection flags <2> indicaUng if it is judged according to ^^^^^^^^^^^^ 

whether or not writing the bootstrap or IPL is attempted that ciw 

the files are infected with viruses, infection flags <3> '* 

indicating if it is judged according to whether or not writing Bv contrast, when it is judged that a file is not infected 

an executable file is attempted that the files are infected with 30 with a virus, the file is stored in the original information 

a virus, infection flags <4> indicating if original information management file 34 and version upgrade information man- 

stored in the original information management file 34 is agement file 35 which are destinations of registration, His- 

infected with a virus, and infection flags <5> indicating if tory information is created and stored in the version upgrade 

differential information brought about due to modification information management file 35 (step SI 54). The file (when 

which is stored in the version upgrade information manage- 35 a registered file contains differential information brought 

ment file 35 is infected with a virus. Thus, the aforesaid about due to modification, the file is a file created by 

information is managed. Whether or not original informa- merging the information with original information) is then 

tion stored in the original information management file 34 is expanded on the disk 30. At the same time, data is registered 

infected with a virus and whether or not differential infor- in the file information management file 36 (step S155). 

mation brought about due to modification which is stored in 4Q As mentioned above, original information of a file which 

the version upgrade information management file 35 is is not infected with a virus is registered in the original 

infected with a virus is judged by the virus checker or information management file 34. Differential information 

according to whether writing the bootstrap, the IPL, or an brought about due to modification concerning the file which 

executable file is attempted. is not infected with a virus is registered in the version 

Herein, in the storage area of an execution/date type flag, 45 upgrade information management file 35. A file that contains 

"1" is set relative to an executable file and "0" is set relative the original information merged with the differential infor- 

to a data file. In the storage are a of a starting portion flag,"!" mation brought about due to modification and that is not 

is set in case a file belongs to a bootstrap or IPL, and "0" is infected with a virus is then expanded on the disk 30. Herein, 

set in any other case. In the storage area of infection flag <1> the reason why the system is designed so that a virus checker 

or <2>, "1" is set when infection with a virus is detected, and 50 is not stored on the disk 30 in advance but produced prior to 

"0" is set when infection with a virus it not detected. In the checking on infection with a virus is to prevent the virus 

storage area of infection flag <3>, "1" is set when infection checker itself from being infected with a vims, 

with a virus is suspected, and "0" is set when infection with [ n the second example of a processing flow in FIG. 15, it 

a virus is not suspected. In the storage area of infection flag ^ confirmed that original information of a file registered in 

<4> or <5>, "1" is set when infection with a virus is 5S the original information management file 34 is not infected 

suspected, and "0" is set when infection with a virus is w i tn a virus, and it is also confirmed that differential 

neither detected nor suspected. information brought about due to modification concerning 

FIGS. 14 to 23 describe some examples of processing the file registered in the version upgrade information man- 
flows executed by the storage device 1 having the function agement file 35 is not infected with a virus. A file that is 
of coping with a computer virus which is configured as 60 expanded on the disk 30 by merging original information 
mentioned above. Next, operations performed by the storage with differential information brought about due to modifi- 
device 1 having the function of coping with a computer virus cation is checked by processing that will be described later 
in accordance with the present invention will be described in in order to see if the file is infected with a virus. The 
detail in conjunction with these examples of processing confirmation is therefore not absolutely needed. In the 
flows. 65 description of the second example of a processing flow in 

When activated, the storage device 1 having the function FIG. 15, the storage device 1 having the function of coping 

of coping with a computer virus initializes the infected-file with a computer virus actuates a virus checker. Alternatively, 


04/27/2004, EAST Version: 1.4.1 


5,9: 

15 

the system may be designed so that the personal computer 2a 
actuates the virus checker. 

As mentioned above, in this embodiment of the present 
invention, it is judged that a file being stored on the disk 30 
and attempting to write a bootstrap or an IPL is infected with 
a virus. This is attributable to the fact that a normal file will 
not perform such writing. 

As described later, since the present invention adopts the 
system design of prohibiting a file infected with a virus from 
running, a file attempting to write a bootstrap or IPL is 
prohibited from running. This means that the bootstrap or 
IPL cannot be registered. In the present invention, therefore, 
when a specific command instructing registration of the 
bootstrap or IPL is issued, the registration is permitted. 

As shown in the third example of a processing flow in 
FIG. 16, when a specific command instructing registration of 
a bootstrap of IPL is issued, the storage device 1 having the 
function of coping with a computer virus registers the 
bootstrap or IPL, for which a registration request has been 
made, in the original information management file 34 (step 
SI 61), and fetches the bootstrap or IPL into the RAM 33 and 
stores it on the disk 30 (step S162). Along with storage on 
the disk 30, "1" is set in the storage area of a starting portion 
flag in the file information management file 36. It is thus 
registered that a file stored is a bootstrap or IPL. "1** is set 
in the storage area of an execution/data type flag, whereby 
it is registered that the file stored is an executable file. 
Infection flags <1> to <5> are set to "0," whereby it is 
registered that the file stored is not infected with a virus (step 
S163). 

Next, virus-infected file detection to be executed by the 
storage device 1 having the function of coping with a 
computer virus will be described. The detection falls into 
two procedures; a procedure to be executed using a virus 
checker, and a procedure to be executed by judging the 
attribute of a writing-destination file. FIGS. 17 and 18 
describe a processing flow of virus- infected file detection to 
be executed using a virus checker (first half and second half 
of the fourth example). FIG. 19 describes a processing flow 
(fifth example) of virus-infected file detection to be executed 
by judging the attribute of a writing-destination file. 

For detecting a virus-infected file using a virus checker, 
the storage device 1 having the function of coping with a 
computer virus first waits, as described in the fourth example 
of a processing flow shown in FIGS. 17 and 18, for the start 
of a period of detecting a virus-infected file. When it is 
judged that the detecting period starts, control is passed to 
step S172. Original information of a virus checker which is 
stored in the original information management file 34 is 
merged with the latest differential information brought about 
due to modification concerning the virus checker which is 
stored in the version upgrade information management file 
35 in order to produce the latest virus checker. The produced 
virus checker is expanded in the RAM 33. 

Thereafter, one of the unprocessed files on the disk 30 is 
extracted at step S173. At step SI 74, the produced virus 
checker is used to check if the extracted file is infected with 
a virus. When it is judged by the checking that a file is 
infected with a virus, control is passed to step S175. "1" is 
recorded as infection flag <1> associated with the file in the 
file information management file 36, whereby it is registered 
that the rile is infected with a virus. By contrast, when it is 
judged that the file is not infected with a virus, control is 
passed to step S176. "0" is recorded as infection flag <1>, 
whereby it is registered that the file is not infected with a 
virus. 
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At step S177, it is judged that all the files stored on the 
disk 30 have been processed. If it is judged that an unproc- 
essed file is left, control is returned to step SI 73. If it is 
judged that no unprocessed file is left, control is passed to 

S step S178. It is judged if a mode, in which original infor- 
mation stored in the original information management file 
34 and differential information brought about due to modi- 
fication which is stored in the version upgrade information 
management file 35 are also subjected to virus check, is 

10 designated. If the mode in which both the original informa- 
tion and differential information brought about due to modi- 
fication are subjected to virus check is not designated, 
control is returned to step S171. 

By contrast, if it is judged that the mode, in which both the 

15 original information stored in the original information man- 
agement file 34 and the differential information brought 
about due to modification which is stored in the version 
upgrade information management file 35 are also subjected 
to virus check, is designated, control is passed to step S181 

20 described in FIG. 18. One of the original information and 
differential information brought about due to modification is 
expanded in a work area in the RAM 33. At step S182, the 
produced virus checker is used to check if the file expanded 
in the work area is infected with a virus. The virus check for 

25 original information or differential information brought 
about due to modification is carried out in order to deal with 
emergence of a new kind of virus. 

If it is judged by the virus check that the file is not infected 
with a virus, control is passed to step SI 83. "O" is recorded 

30 as infection flags <4> and <5> associated with the file in the 
file information management file 36. It is thus registered that 
the file is not infected with a virus. By contrast, when it is 
judged that the file is infected with a virus, control is passed 
to step S184. "1" is recorded as infection flags <4> and <5> 

35 associated with the file in the file information management 
file 36. It is thus registered that the original information is 
infected with a virus. 
At step S185, it is judged if all original information and 

40 differential information brought about due to modification 
have been processed. If it is judged that an unprocessed file 
is left, control is returned to step S181. If it is judged that no 
unprocessed file is left, control is returned to step S171 in 
FIG. 17. 

45 As mentioned above, the storage device 1 having the 
function of coping with a computer vims uses a virus 
checker to periodically check if files stored on the disk 30, 
original information stored in the original information man- 
agement file 34, and differential information brought about 

50 due to modification which is stored in the version upgrade 
information management file 35 are infected with viruses. 
The results of the check are registered in the form of 
infection flags <1>, <4>, and <5> in the file information 
management file 36. 

55 In the fourth example of a processing flow shown in 
FIGS. 17 and 18, a virus checker is activated at intervals of 
a specific period. Alternatively, the system may be designed 
so that the virus checker is activated in response to a 
command issued from the personal computer 2a. Moreover, 

60 in the fourth example of a processing flow in FIGS. 17 and 
18, the storage device 1 having the function of coping with 
a computer virus actuates a virus checker. Alternatively, the 
system may be designed so that the personal computer 2a 
actuates the virus checker. 

65 On the other hand, for detecting a virus-infected file by 
judging the attribute of a writing-destination file, when a 
writing request for a file stored on the disk 30 is issued from 
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the personal computer 2a (the writing request is issued by a function of coping with a computer virus judges that a file 

file loaded from the disk 30 to the personal computer 2a\ as which is a source of the writing request is infected with a 

described in the fifth example of a processing flow in FIG. virus. The fact is registered in the form of infection flags <2> 

19, the storage device 1 having the function of coping with and <3> in the file information management file 36. If the 

a computer vims first references the value of a starting 5 writing-destination file belongs to the bootstrap or IPL, 

portion flag in the file information management file 36 so as executing writing is disabled. If the writing-destination file 

to judge if the writing-destination file belongs lo a bootstrap is an executable file, it is determined through interactive 

or IPL. processing if writing should be executed for the file. When 

If it is judged by the judgment at step S191 that the writing is executed, it is judged that the writing-destination 

writing-destination file belongs to the bootstrap or IPL, i° file will also be infected with a virus. The fact is registered 

control is passed to step S192, It is then judged that the file in the form of infection flag <3> in the file information 

having issued the writing request is infected with a virus. "1" management file 36, 

is recorded as infection flag <2> associated with the file in Next, processing to be executed for a vims-infected file by 

the file information management file 36, whereby it is the storage device 1 having the function of coping with a 

registered that the file is infected with a virus. At step S193, 15 computer vims will be described. 

it is reported to the personal computer 2a that the file which When receiving a loading request made for a file 

made the writing request is a file infected with a vims. The (executable file) stored on the disk 30 from the personal 

processing is then terminated without writing. computer 2a, as described in the sixth example of a pro- 

By contrast, if it is judged at step S191 that the writing- cessing flow in FIG. 20, the storage device 1 having the 
destination file does not belong to the bootstrap or IPL, 20 function of coping with a computer vims references infec- 
control is passed to step S194. The value of an execution/ tion flags <1>, <2>, and <3> in the file information man- 
data type flag in the file information management file 36 is agement file 36 (step S201) so as to check if the file for 
referenced in order to judge if the writing-destination file is which the loading request is made is infected with a virus, 
an executable file or data file. If it is judged that the When it is judged that the file is not infected with a virus, the 
writing-destination file is a data file, writing is executed for 25 file is loaded into the personal computer 2a. Running the file 
the file at step S195. The processing is then terminated. is thus instructed (step S202). By contrast, when it is judged 

By contrast, if it is judged at step S194 that the writing- that the file is infected with a vims, loading the file is 

destination file is an executable file, it is judged that it is rejected (step S203). Running the file is thus prevented, 

highly probable that the file having issued the writing ^ As mentioned above, the storage device 1 having the 

request is infected with a virus. Control is then passed to step function of coping with a computer vims gives control so 

SI 96. While the fact is being reported, a message asking if that a vims- infected file registered in the file information 

writing should be executed is output to the personal com- management file 36 will not be run. Consequently, a file that 

puter 2a. A response to the inquiry is duly received. is detected to be infected with a vims by a vims checker will 

If it is judged at step SI 9 6 that the response from the 35 never be run. A file that has evaded checking by the vims 

personal computer 2a instructs that writing should not be checker and that is detected to be infected with a vims in 

executed, control is passed to step S197. "1" is recorded as terms of the attribute of a writing-destination file will not be 

infection flag <3> associated with the file, which has issued rerun. Thus, proliferation of the vims can be reliably pre- 

the writing request, in the file information management file vented. 

36, whereby it is registered that the file is infected with a 4Q In the sixth example of a processing flow in FIG. 20, 

virus. The processing is then terminated. running a file infected with a virus is rejected without 

Herein, even when a file that is a source of a writing exception. However, a program may be produced to have a 

request writes itself, "1" is recorded as infection flag <3> pattern resembling the pattern of a vims, and a vims checker 

associated with the file in the file information management may make a mistake in checking. The system may therefore 

file 36. This is attributable not only to the fact that it is highly 45 be designed so that it is determined through interaction with 

probable that a file attempting to write an executable file is the personal computer 2a whether the run rejection should 

infected with a vims, but also to the system design of the be lifted. 

present invention that upgrading a file into a new version is On the other hand, when a command instructing restora- 

realized by registering differential information brought tion of a virus-infected file stored on the disk 30 is issued 

about due to modification in the version upgrade information 50 from the personal computer 2a, as described in the seventh 

management file 35 and that upgrading a file into a new example of a processing flow in FIG. 21, the storage device 

version without following this procedure is illegal. 1 having the function of coping with a computer vims first 

By the way, if it is judged at step S196 that a response references infection flags <1>, <2>, and <3> in the file 

from the personal computer 2a instructs that writing should information management file 36, extracts one file infected 

be executed, although it is highly probable that the file that ss with a vims, and deletes the file from the disk 30 at step 

is a source of the writing request is infected with a vims, it S211. At step S212, the data of the deleted file is deleted 

is inst meted to ignore the probability. Control is therefore from the file information management file 36, 

passed to step S198. Writing is executed for the writing- At step S213, infection flag <4> in the file information 

destination file. At step S199, "1" is recorded as infection management file 36 is referenced, and original information 

flags <3> associated with the writing-source and writing- 60 of the deleted file, which is not infected with a vims, is read 

destination files in the file information management file 36, from the original information management file 34. Infection 

whereby it is registered that the files are infected with a flag <5> in the file information management file 36 is 

virus. The processing is then terminated. referenced, and the latest differential information brought 

As mentioned above, when a writing request is issued for about due to modification concerning the deleted file, which 

a file stored on the disk 30, if the writing-destination file 65 is not infected with a virus, is read from the original 

belongs to a bootstrap or IPL, or if the writing-destination information management file 34. The original information is 

file is an executable file, the storage device 1 having the then merged with the differential information brought about 
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due to modification in order to restore the deleted file. The expanded on the disk 30. At step S227, data of the restored 

restored file is then expanded on the disk 30. At step S214, file is registered in the file information management file 36. 

data of the restored file is registered in the file information At step S228, it is judged if an unprocessed virus-infected 

management file 36. At step S215, it is judged if an unproc- file is left. If no unprocessed file is left, the processing is 

essed virus-infected file is left. If no unprocessed file is left, 5 terminated. If an unprocessed file is left, control is returned 

the processing is terminated. If an unprocessed file is left, to step S221. 

control is returned to step S211. As mentioned above, the storage device 1 having the 

As mentioned above, the storage device 1 having the function of coping with a computer virus deletes a file 

function of coping with a computer virus deletes a file infected with a virus from the disk 30, restores the file into 

infected with a virus from the disk 30. Original information 10 an uninfected one that is not infected with a virus using 

of the file and differential information brought about due to original information and differential information brought 

modification are used to restore the infected file into an about due to modification concerning the file, and expands 

uninfected one. The file not infected with a virus is then the restored file on the disk 30. At this time, the file infected 

expanded on the disk 30. with a virus and virus information concerning the file are 

In the seventh example of a processing flow in FIG. 21, 15 saved m the ^executable area 37. 

when a restoration command is issued for a virus- infected The virus-infected file and virus information concerning 

file from the personal computer 2a, restoring the virus- the file, which are saved in the inexecutable area 37, become 

infected file is executed. Alternatively, the system may be very useful information for analysis of an intruding virus, 

designed so that restoration is executed at intervals of a However, if anybody is allowed to access this kind of useful 

specific period. Restoring the virus-infected file may thus be 20 information, there arises a fear that the information may be 

executed. When this system design is adopted, a file infected rewritten by mistake. 

with a virus can be restored autonomously irrespective of the When a command instructing reading of saved informa- 

personal computer 2a. In the seventh example of a process- tion from the inexecutable area 37 is issued from the 

ing flow in FIG. 21, the latest differential information personal computer 2a, as describe in the ninth example of a 

brought about due to modification which is not infected with 25 processing flow in FIG. 23, the storage device 1 having the 

a virus is used to restore a file infected with a virus into the function of coping with a computer virus first requests entry 

latest one. Alternatively, the system may be designed so that of an ID number and password which have been registered 

differential information brought about due to modification according to the processing flow (first example) described in 

which is identified by an instruction sent from the personal FIG. 14 (step S231), and collates the ID number and 

computer 2a and pointed out by history information is used 30 password entered in response to the request with those 

for restoration. registered according to the processing flow in FIG. .14 to see 

When the seventh example of a processing flow in FIG. if they agree with each other (step S232). Under the condi- 

21 is employed, the storage device 1 having the function of tion that they agree with each other, a virus-infected file and 

coping with a computer virus executes the processing of virus information which are saved in the inexecutable area 

restoring a file infected with a virus into an uninfected file. 37 are read and output to the personal computer 2a (step 

At this time, as described in the eighth example of a S233). When a deletion request is issued for the extracted 

processing flow in FIG. 22, the file infected with a virus and virus -infected file and virus information from the personal 

virus information concerning the file-infected file may be computer 2a (step S234), deletion is executed (step S235). 

saved in the inexecutable area 37. 4() As mentioned above, the storage device 1 having the 

Specifically, according to the eighth example of a pro- function of coping with a computer virus reads a virus- 

cessing flow in FIG. 22, when a command instructing infected file and virus information, which are saved in the 

restoration of a virus-infected file stored on the disk 30 is inexecutable area 37, under the condition that an ID number 

issued from the personal computer 2a, the storage device 1 and password agree with internal data, 

having the function of coping with a computer virus first 45 In the ninth example of a processing flow in FIG. 23, 

references infection flags <1>, <2>, and <3> in the file when a Read command is issued for the inexecutable area 37 

information management file 36 and extracts one file from the personal computer 2a, saved information is read 

infected with a virus at step S221. At step S222, a virus from the inexecutable area 37. Alternatively, the system may 

checker expanded in advance is used to specify virus infor- be designed so that the saved information is read from the 

mation concerning the extracted virus-infected file. At step 50 inexecutable area 37 by executing reading at intervals of a 

S223, the extracted virus- infected file and virus information specific period. For further improving security, an encoding 

specified at step S223 are saved in the inexecutable area 37. mechanism for converting a virus-infected file and virus 

At step S224, the extracted virus-infected file is deleted from information, which are saved in the inexecutable area 37, 

the disk 30. into encoded data may be prepared. The encoded data 

At step S225, data of the deleted file is deleted from the 55 produced by the encoding mechanism is then stored in the 

file information management file 36. At step S226, infection inexecutable area 37. In addition, a decoding mechanism for 

flag <4> in the file information management file 36 is executing inverse conversion that is inverse to the conver- 

referenced, and original information of the deleted file which sion performed by the encoding mechanism may be pre- 

is not infected with a virus is read from the original P are d- In this case, the virus-mfected file and virus uifor- 

information management file 34. Infection flag <5> in the 60 mation w b ich are saved in the ^executable area 37 are read 

file information management file 36 is referenced, and the usin S the decoding mechanism. 

latest differential information brought about due to modifi- FIGS. 24 to 30 are block diagrams for explaining several 

cation concerning the deleted file which is not infected with examples (first to seventh examples) of an anti-virus opera- 

a virus is read from the original information management tion performed in the basic embodiment shown in FIG. 2. 

file 34. The original information is then merged with the 65 In the storage device 1 having the function of coping with 

differential information brought about due to modification in a computer virus in accordance with the present invention 

order to restore the deleted file. The restored file is then shown in FIG. 2, as shown in FIG. 24 for explaining the first 
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example of an ami -virus operation, a virus checker 40 management file 35. When the timer 44 issues an instruction 

(which may be run by the personal computer 2a or storage for a virus check, the file generating mechanism 42 gener- 

device 1 having the function of coping with a computer ates the virus checker 40. The thus-generated virus checker 

virus) checks if a file expanded on the disk 30 is infected 40 (that may be run by the personal computer 2a or storage 

with a virus. The result of the checking is received and 5 device 1 having the function of coping with a computer 

registered in the file information management file 36. Thus, virus) checks if a file expanded on the disk is infected with 

the file information management file 36 is used to manage a virus. The result of the checking is registered in the file 

the information indicating if files expanded on the disk 30 information management file 36. Thus, the virus checker 40 

are infected with viruses. Furthermore, as shown in FIG. 25 is protected from being infected with a virus, and intrusion 

for explaining the second example of an anti-virus 10 of the virus is prevented. Alphanumeric characters in paren- 

operation, when a use request is made for a file expanded on theses (ID) to (3D), (3E), (4D), and (5D) in FIG. 27 and 

the disk 30 via the personal computer la, the file information (IF), (2F), (2F)', (3F) to (5F) in FIG. 28 denote processing 

management file 36 is referenced to judge if the file for orders. 

which the use request is made is infected with a virus. If the The storage device 1 having the function of coping with 

file is infected with a virus, the use of the file is prohibited. 15 a computer virus in accordance with the present invention, 

Thus, proliferation of the virus is prevented. which has the configuration shown in FIG. 2, includes, as 

In FIGS. 24 and 25, reference numeral 41 denotes a shown in FIG. 29 for explaining the sixth example of an 

management file registering/referencing mechanism for reg- anti-virus operation, a virus check starting mechanism 45 for 

is te ring data in the file information management file 36 and issuing an instruction of virus check in response to an 

referencing the file information management file 36 for data. 2 o instruction sent from the personal computer 2a. 

When the system is designed so that the virus checker 40 is Furthermore, encoded data of original information of the 

run by the storage device 1 having the function of coping virus checker 40 is stored in the original information raan- 

with a computer virus, checking on an infection with a virus agement file 34. Encoded data of differential information 

can be executed concurrently with an operation of the brought about due to modification concerning the virus 

personal computer 2a. Moreover, checking on an infection 2 s checker 40 is stored in the version upgrade information 

with a virus can be executed at night or the like. In case the management file 35. When the virus check starting mecha- 

virus checker 40 is run by the personal computer 2a, the nism 45 issues an instruction of virus check, the file gener- 

virus checker 40 may not be loaded from the storage device ating mechanism 42 generates the virus checker 40. The 

1 having the function of coping with a computer virus but thus-generated virus checker 40 (that may be run by the 

may be prepared separately. Alphanumeric characters in 30 personal computer 2a or storage device 1 having the func- 

parentbeses (1A) to (5 A) in FIG. 24 and (IB) to (3B), (3B)', tion of coping with a computer virus) checks if a file 

(4B), and (5B) in FIG. 25 denote processing orders. expanded on the disk 30 is infected with a virus. The result 

The storage device 1 having the function of coping with of the checking is registered in the file information man- 

a computer virus in accordance with the present invention, agement file 36. Thus, the virus checker 40 is protected from 

which has the configuration shown in FIG. 2, includes, as 35 being infected with a virus, and intrusion of the virus is 

shown in FIG. 26 for explaining the third example of an prevented. Alphanumeric characters (1G) to (3G), (3G)\ 

anti-virus operation, an original information management (4G) to (6G) in the drawing denote processing orders, 

file 34 for encoding and managing original information of Moreover, the storage device 1 having the function of 

files, a version upgrade information management file 35 for coping with a computer virus in accordance with the present 

encoding and managing differential information brought 40 invention, which has the configuration shown in FIG. 2, 

about due to modification concerning the files, a file gener- includes, as shown in FIG. 30 for explaining the seventh 

ating mechanism 42 for decoding and merging encoded data example of an anti-virus operation, a dedicated system 

of original information and differential information brought writing mechanism 46 for writing a bootstrap or IPL on the 

about due to modification so as to generate a file, and a disk 30. When the system writing mechanism 46 is used to 

deleting mechanism 43 for deleting a file from the disk 30. 45 run a program, writing the bootstrap or IPL on the disk 30 

When it is judged that a file for which a use request is made is permitted. This is intended to guarantee normal writing as 

is infected with a virus, the deleting mechanism 43 is used an exception to the rule that a file attempting to write the 

to delete the virus-infected file from the disk 30. The file bootstrap or IPL on the disk 30 is judged to be infected with 

generating mechanism 42 is used to restore the virus- a virus and that executing the file is prohibited, 

infected file into an uninfected one that is not infected with 50 In the aforesaid examples shown in FIGS. 24 to 30, a file 

a virus and expand the file on the disk 30. The system can infected with a virus is detected by the virus checker 40. In 

therefore be operated by performing a minimum scale of addition, a file attempting to write a bootstrap or IPL or an 

installation. In the drawing, alphanumeric characters in executable file is judged to be infected with a virus. Aside 

parentheses (1C) to (14C) denote processing orders. from this, if the criteria described below are added, infection 

Moreover, the storage device 1 having the function of 55 with a virus can be prevented more reliably. That is to say, 

coping with a computer virus in accordance with the present when the size of a file is varied by running the file, the file 

invention, which has the configuration shown in FIG. 2, stored on the disk 30 is judged to be infected with a virus (for 

includes, as shown in FIG. 27 for explaining the fourth example, judged periodically). Although a file stored on the 

example of an anti-virus operation, a timer 44 for issuing a disk 30 is judged to be an executable file in terms of the fine 

virus check instruction periodically (which may be incor- 60 name, if the file is declared to be a data file in the file 

porated in the personal computer 2a as shown in FIG. 28 for information management file 36, the file stored on the disk 

explaining the fifth example of an anti-virus operation). 30 is judged to be infected with a virus (for example, judged 

Furthermore, encoded data of original information of the at the start of processing). Although a file is stored on the 

virus checker 40 is stored in the original information man- disk 30, if original information is not registered in the 

agement file 34. Encoded data of differential information 65 original information management file 36 and differential 

brought about due to modification concerning the virus information brought about due to modification is not regis- 

checker 40 is stored in the version upgrade information tered in the version upgrade information management file 
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37, the file stored on the disk 30 is judged to be infected with 
a virus (judged periodically or at the time of access to the 
file). 

Checking if the size of a file is varied by running the file 
is achieved by, for example, merging original information 
managed in the original information management file 34 
with differential information brought about due to modifi- 
cation which is managed in the version upgrade information 
management file 35 in order to produce a file, and by 
comparing the size of the produced file with the size of the 
file stored on the disk 30. 

As described so far, in several preferred embodiments of 
a storage device 1 having the function of coping with a 
computer virus in accordance with the present invention, 
infection with a virus is prevented actively. The use of a file 
infected with a virus is prohibited, and the file is restored 
automatically. Furthermore, information concerning infec- 
tion with viruses is preserved so that it cannot be accessed 
readily. Consequently, a storage device capable of properly 
dealing with infection with a virus can be constructed. 

We claim: 

1. A storage device, having the function of coping with a 
computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit forjudging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; and 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus. 

2. A storage device having the function of coping with a 
computer virus according to claim 1, wherein said virus 
checker is designed to be run by said storage device having 
the function of coping with a computer virus. 

3. A storage device having the function of coping with a 
computer virus according to claim 2, wherein said virus 
checker is designed to be activated at intervals of a specific 
period. 

4. A storage device having the function of coping with a 
computer virus according to claim 2, wherein said virus 
checker is designed to be activated in response to a com- 
mand instruction. 

5. A storage device having the function of coping with a 
computer virus according to claim 2, wherein when a writing 
request is issued for a system startup area stored on said disk, 
said table registering unit judges that a file which is stored 
on said disk and is a source of the writing request is infected 
with a virus, and registers the fact in said infection man- 
agement table unit. 

6. A storage device having the function of coping with a 
computer virus according to claim 5, further comprising an 
invalidating unit that when a writing request is issued for a 
system startup area stored on said disk, invalidates the 
writing request. 

7. A storage device having the function of coping with a 
computer virus according to claim 5, further comprising a 
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determining unit for determining through interactive pro- 
cessing whether the use of a virus-infected file that is 
registered in said infection management table unit should be 
permitted, wherein said prohibiting unit does not prohibit 
5 the use of a file which is permitted by said determining unit. 

8. A storage device having the function of coping with a 
computer virus according to claim 5, further comprising a 
first managing unit for managing original information of 
files stored on said disk, a second managing unit for man- 
aging differential information brought about due to modifi- 
cation concerning the files stored on said disk and history 
information concerning the differential information brought 
about due to modification, and a file registering unit for 
merging original information of a file managed by said first 
managing unit with differential information brought about 

15 due to modification concerning the file which is managed by 
said second managing unit so as to produce a file, and for 
registering the produced file on said disk. 

9. A storage device having the function of coping with a 
computer virus according to claim 5, further comprising a 

20 saving unit for saving a virus- infected file that is registered 
in said infection management table unit and virus informa- 
tion concerning the file in an inexecutable area, and a 
reading unit for reading information saved in said inexecut- 
able area under the condition that permission information for 

25 permitting access to said inexecutable area is given. 

10. A storage device having the function of coping with a 
computer virus according to claim 2, when a writing request 
is issued for an executable file stored on said disk, said table 
registering unit judges that a file which is stored on said disk 

30 and is a source of the writing request is infected with a virus, 
and registers the fact in said infection management table 
unit. 

11. A storage device having the function of coping with a 
computer virus according to claim 2, wherein when the size 

35 of a file is varied by running the file, said table registering 
unit judges that the file, said table registering unit judges that 
the file stored on said disk is infected with a virus, and 
registers the fact in said infection management table unit. 

12. A storage device having the function of coping with a 
40 computer virus according to claim 2, wherein although a file 

stored on said disk is judged to be an executable file in terms 
of the file name, if the file is declared to be a data file, said 
table registering unit judges that the file stored on said disk 
is infected with a virus, and registers the fact in said 
45 infection management table unit. 

13. A storage device having the function of coping with a 
computer virus according to claim 2, further comprising a 
determining unit for determining through interactive pro- 
cessing whether the use of a virus-infected file that is 

50 registered in said infection management table unit should be 
permitted, wherein said prohibiting unit does not prohibit 
the use of a file which is permitted by said determining unit. 

14. A storage device having the function of coping with a 
computer vims according to claim 25, further comprising an 

55 invalidating unit that when a writing request is issued for a 
system startup area stored on said disk, invalidates the 
writing request. 

15. A storage device having the function of coping with a 
computer virus according to claim 14, further comprising a 

60 dedicated writing unit for executing writing for a system 
startup area stored on said disk, wherein when a writing 
request is issued for the system startup area stored on said 
disk, if the writing request specifies the use of said writing 
unit, said invalidating unit does not invalidate the writing 

65 request. 

16. A storage device having the function of coping with a 
computer virus according to claim 2, further comprising a 
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first managing unit for managing original information of 
files stored on said disk, a second managing unit for man- 
aging differential information brought about due to modifi- 
cation concerning the files stored on said disk and history 
information concerning said differential information brought 
about due to modification, and file registering unit for 
merging the original information of a file managed by said 
first managing unit with the differential information brought 
about due to modification concerning the file which is 
managed by said second managing unit so as to produce a 
file, and for registering the produced file on said disk. 

17. A storage device having the function of coping with a 
computer virus according to claim 2, further comprising a 
saving unit for saving a virus-infected file that is registered 
in said infection management table unit and virus informa- 
tion concerning the file in an inexecutable area, and a 
reading unit for reading information saved in said inexecut- 
able area under the condition that permission information for 
permitting access to said inexecutable area is given. 

18. A storage device having the function of coping with a 
computer virus according to claim 26, further comprising a 
permitting unit for determining through interactive process- 
ing whether a writing request made for a file, which is 
registered as a virus-infected file by said table registering 
unit and is running, should be permitted. 

19. A storage device having the function of coping with a 
computer virus according to claim 18, wherein when a 
writing request is permitted by said permitting unit, if a file 
that is a destination of the writing request is rewritten, said 
table registering unit judges that the file which is stored on 
said disk and is the destination of the writing request is 
infected with a virus and registers the fact in said infection 
management table unit. 

20. A storage device having the function of coping with a 
computer virus according to claim 18, further comprising a 35 
determining unit for determining through interactive pro- 
cessing whether the use of a virus-infected file that is 
registered in said infection management table unit should be 
permitted, wherein said prohibiting unit does not prohibit 
the use of a file which is permitted by said determining unit. 40 

21. A storage device having the function of coping with a 
computer virus according to claim 18, further comprising a 
first managing unit for managing original information of 
files stored on said disk, a second managing unit for man- 
aging differential information brought about due to modifi- 
cation concerning the files stored on said disk and history 
information concerning the differential information brought 
about due to modification, and a file registering unit for 
merging original information of a file managed by said first 
managing unit with differential information brought about 
due to modification concerning the file which is managed by 
said second managing unit so as to produce a file, and for 
registering the produced file on said disk. 

22. A storage device having the function of coping with a 
computer vims according to claim 18, further comprising a 55 
saving unit for saving a virus-infected file that is registered 

in said infection management table unit and virus informa- 
tion concerning the file in an inexecutable area, and a 
reading unit for reading information saved in said inexecut- 
able area under the condition that permission information for 
permitting access to said inexecutable area is given. 

23. A storage device having the function of coping with a 
computer virus according to claim 1, wherein said virus 
checker is designed to be activated at intervals of a specific 
period. 

24. A storage device having the function of coping with a 
computer virus according to claim 1, wherein said virus 
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checker is designed to be activated in response to a com- 
mand instruction. 

25. A storage device having the function of coping with a 
computer virus according to claim 1, wherein when a writing 
request is issued for a system startup area stored on said disk, 
said table registering unit judges that a file which is stored 
on said disk and is a source of the writing request is infected 
with a virus, and registers the fact in said infection man- 
agement table unit. 

26. A storage device having the function of coping with a 
computer virus according to claim 1, wherein when a writing 
request is issued for an executable file stored on said disk, 
said table registering unit judges that a file which is stored 
on said disk and is a source of the writing request is infected 
with a virus, and registers the fact in said infection man- 
agement table unit, 

27. A storage device having the function of coping with a 
computer virus according to claim 1, wherein when the size 
of a file is varied by running the file, said table registering 
unit judges that the file stored on said disk is infected with 
a virus, and registers the fact in said infection management 
table unit. 

28. A storage device having the function of coping with a 
computer virus according to claim 1, wherein although a file 
stored on said disk is judged to be an declared to be a data 
file, said table registering unit judges that the file stored on 
said disk is infected with a virus, and registers the fact in said 
infection management table unit. 

29. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising a 
determining unit for determining through interactive pro- 
cessing whether the use of a virus-infected file that is 
registered in said infection management table unit should be 
permitted, wherein said prohibiting unit does not prohibit 
the use of a file which is permitted by said determining unit. 

30. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein said first managing unit manages original infor- 
mation that is confirmed not to be infected with a virus 
by said virus checker, and said second managing unit 
manages differential information brought about due to 
modification which is confirmed not to be infected with 
a virus by said virus checker. 

31. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 

a file registering unit for merging the origina] information 
of a file managed by said first managing unit with the 
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differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 
wherein as for a file which is stored on said disk, of which 5 
original information is not registered in said first man- 
aging unit, and of which differential information 
brought about due to modification is not registered in 
said second managing unit, said table registering unit 
judges that the file stored on said disk is infected with 10 
a virus and registers the fact in said infection manage- 
ment table unit. 

32. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 15 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 20 
modification; and 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 25 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein said first managing unit manages original infor- 
mation of said virus checker, and said second managing 
unit manages differential information brought about 30 
due to modification concerning said virus checker and 
history information concerning the differential infor- 
mation brought about due to modification. 

33. A storage device having the function of coping with a 
computer virus according to claim 32, wherein said gener- 
ating unit generates said virus checker at the time of running 
said virus checker. 

34. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 45 
said differential information brought about due to 
modification; and 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 50 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein said first managing unit encodes and manages 
original information, and said second managing unit 55 
encodes and manages differential information brought 
about due to modification, further comprising a decod- 
ing unit for decoding encoded data managed by said 
first and second managing unit, and an encoding unit 
for executing inverse conversion that is inverse to 60 
conversion performed by said decoding unit 

35. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 65 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
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stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; and 

a saving unit for saving a virus-infected file that is 
registered in said infection management table unit and 
virus information concerning the file in an executable 
area, and a reading unit for reading information saved 
in said inexecutable area under the condition that 
permission information for permitting access to said 
inexecutable area is given. 

36. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; and 

a restoring unit for deleting a virus- infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk, 

wherein said first managing unit encodes and manages 
original information, and said second managing unit 
encodes and manages original information, and said 
second managing unit encodes and manages differen- 
tial information brought about due to modification, 
further comprising a decoding unit for decoding 
encoded data managed by said first and second man- 
aging units, and an encoding unit for executing inverse 
conversion that is inverse to conversion performed by 
said decoding unit. 

37. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; 

a restoring unit for deleting a virus-infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk; and 
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a saving unit for saving a virus-infected file that is 
registered in said infection management table unit and 
virus information concerning the file in an inexecutable 
area, and a reading unit for reading information saved 
in said inexecutable area under the condition that S 
permission information for permitting access to said 
inexecutable area is given. 

38. A storage device, having the function of coping with 
computer virus, which has the ability to deal with infection 

f a file stored on a disk with a virus, comprising: 10 
an infection management table unit used to manage files 
stored on said disk to see if the files are infected with 
viruses; 

a table registering unit for receiving a result of detection 
from a virus checker for detecting if a file stored on said 15 
disk is infected with a virus, and for registering the 
result in said infection management table unit; 

a judging unit that, when a use request is made externally 
for a file stored on said disk, references said infection 2Q 
management table unit so as to judge if the file is 
infected with a virus; 

a prohibiting unit that, when said judging unit judges that 
a file is infected with a virus, prohibits the use of the 
file, wherein when a writing request is issued for a 25 
system startup area stored on said disk, said table 
registering unit judges that a file which is stored on said 
disk and is a source of the writing request is infected 
with a virus, and registers the fact in said infection 
management table unit; and 30 

a file registering unit for merging original information of 
a file managed by a first managing unit with differential 
information brought about due to modification con- 
cerning a file which is managed by a second managing 
unit so as to produce a produced file, and for registering 35 
the produced file on said disk. 

39. A storage device, having the function of coping with 
computer virus, which has the ability to deal with infection 
f a file stored on a disk with a virus, comprising: 

an infection management table unit used to manage files 40 
stored on said disk to see if the files are infected with 
viruses; 

a table registering unit for receiving a result of detection 
from a virus checker for detecting if a file stored on said 
disk is infected with a virus, and for registering the 45 
result in said infection management table unit; 

a judging unit that, when a use request is made externally 
for a file stored on said disk, references said infection 
management table unit so as to judge if the file is 
infected with a virus; 50 

a prohibiting unit that, when said judging unit judges that 
a file is infected with a virus, prohibits the use of the 
file; 

a saving unit for saving a virus-infected table unit and 5S 
virus information concerning the file in an inexecutable 
area; 

a reading unit for reading information saved in said 
inexecutable area under the condition that permission 
information for permitting access to said inexecutable 60 
area is given; and 

a file registering unit for merging original information of 
a file managed by a first managing unit with differential 
information brought about due to modification con- 
cerning a file which is managed by a second managing 65 
unit so as to produce a produced file, and for registering 
the produced file on said disk. 
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40. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit used to manage files 
stored on said disk to see if the files are infected with 
viruses; 

a table registering unit for receiving a result of detection 
from a virus checker for detecting if a file stored on said 
disk is infected with a virus, and for registering the 
result in said infection management table unit; 

a judging unit that, when a use request is made externally 
for a file stored on said disk, references said infection 
management table unit so as to judge if the file is 
infected with a virus; 

a prohibiting unit that, when said judging unit judges that 
a file is infected with a virus, prohibits the use of the 
file; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a produced file, 
and for registering the produced file on said disk; 

a restoring unit for deleting a virus-infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk. 

41. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit used to manage files 
stored on said disk to see if the files are infected with 
viruses; 

a table registering unit for internally receiving a result of 
detection from a virus checker which internally detects 
that a file stored on said disk is infected with a virus, 
and for registering the result in said infection manage- 
ment table unit; 

a judging unit that, when a use request is made externally 
for a file stored on said disk, references said infection 
management table unit so as to judge if the file is 
infected with a virus; 

a prohibiting unit that, when said judging unit judges that 
a file is infected with a virus, prohibits the use of the 
file; and 

a file registering unit for merging original information of 
a file managed by a first managing unit with differential 
information brought about due to modification con- 
cerning a file which is managed by a second managing 
unit so as to produce a produced file, and for registering 
the produced file on said disk. 

42. A method of storing a computer program on a com- 
puter storage device, having the function of coping with a 
computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising the steps 
of: 

managing files stored on said disk to see if the files are 
infected with viruses; 
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receiving a result of detection from a virus checker for 
detecting if a file stored on said disk is infected with a 
virus; 

registering the result of detection; 

referencing said infection management table unit so as to 
judge if the file is infected with a virus when a use 
request is made externally for a file stored on said disk; 

prohibiting the use of the file when judging that a file is 
infected with a virus; 

judging that a stored file on said disk is a source of the use 
request infected with a virus and registering when the 
use request is issued for a system startup area stored on 
said disks; 

merging original information of a file managed by a first is 
managing unit with differential information brought 
about due to modification concerning a file which is 
managed by a second managing unit so as to produce 
a produced file; and 

registering the produced file on said disk. 

43. A method of storing a computer program on a com- 
puter storage device, having the function of coping with a 
computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising the steps 
of: 

managing files stored on said disk to see if the files are 

infected with viruses; 
receiving a result of detection from a virus checker for 

detecting if a file stored on said disk is infected with a 3Q 

virus; 

registering the result of detection; 

judging if the file is infected with a virus when a use 
request is made externally for a file stored on said disk; 

prohibiting use of the infected file when judging that a file 35 
is infected with a virus; 

saving a virus- infected table and virus information con- 
cerning the file in an inexecutable area; 

reading information saved in said inexecutable area under 4Q 
the condition that permission information for permit- 
ting access to said inexecutable area is given; 

merging original information of a file managed by a first 
managing unit with differential information brought 
about due to modification concerning a file which is 45 
managed by a second managing unit so as to produce 
a produced file; and 

registering the produced file on said disk. 

44. A method of storing a computer program on a com- 
puter storage device, having the function of coping with a so 
computer virus, which has the ability to deal with infection 

of a file stored on a disk with a virus, comprising the steps 
of: 

managing files stored on said disk to see if the files are 
infected with viruses; 55 

receiving a result of detection from a virus checker for 
detecting if a file stored on said disk is infected with a 
virus; 

registering the result of detection; 

judging if the file is infected with a virus when a use 
request is made externally for a file stored on said disk; 

prohibiting the use of the file when judging that a file is 
infected with a virus; 

managing original information of files stored on said disk; 

managing differential information brought about by modi- 
fication concerning the files stored on said disk and 
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history information concerning said differential infor- 
mation brought about due to the modification; 

merging the original information of a file managed by said 
first managing unit with the differential information 
brought about due to modification concerning the file 
which is managed by said second managing unit so as 
to produce a produced file; 

registering the produced file on said disk; 

deleting a registered virus-infected file from said disk, 
thus restoring the file; and 

registering the restored file on said disk. 

45. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus. 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein said first managing unit manages original infor- 
mation that is confirmed not to be infected with a virus 
by said virus checker, and said second managing unit 
manages differential information brought about due to 
modification which is confirmed not to be infected with 
. a virus by said virus checker. 

46. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 
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a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; s 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 10 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein as for a file which is stored on said disk, of which 
original information is not registered in said first man- 
aging unit, and of which differential information 20 
brought about due to modification is not registered in 
said second managing unit, said table registering unit 
judges that the file stored on said disk is infected with 
a virus and registers the fact in said infection manage- 
ment table unit. 25 

47. A storage device, having the function of coping with 
computer virus, which has the ability to deal with infection 
f a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 
infected files which are stored on said disk; 30 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 35 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 40 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 50 
said differential information brought about due to 
modification; and 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 55 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein said first managing unit manages original infor- 
mation of said virus checker, and said second managing 60 
unit manages differential information brought about 
due to modification concerning said virus checker and 
history information concerning the differential infor- 
mation brought about due to modification. 

48. A storage device, having the function of coping with 65 
computer virus, which has the ability to deal with infection 

f a file stored on a disk with a virus, comprising: 
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an infection management table unit for registering virus 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein said first managing unit encodes and manages 
original information, and said second managing unit 
encodes and manages differential information brought 
about due to modification, further comprising a decod- 
ing unit for decoding encoded data managed by said 
first and second managing unit, and an encoding unit 
for executing inverse conversion that is inverse to 
conversion performed by said decoding unit. 

49. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
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differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; and 

a saving unit for saving a virus-infected file that is 5 
registered in said infection management table unit and 
virus information concerning the file in an executable 
area, and a reading unit for reading information saved 
in said inexecutable area under the condition that 
permission information for permitting access to said 30 
inexecutable area is given. 

50. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 15 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 2Q 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit forjudging if a file is infected with a virus 25 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 30 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 35 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 40 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; 45 

a restoring unit for deleting a virus-infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk, 50 

wherein said first managing unit encodes and manages 
original information, and said second managing unit 
encodes and manages original information, and said 
second managing unit encodes and manages differen- 
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tial information brought about due to modification, 
further comprising a decoding unit for decoding 
encoded data managed by said first and second man- 
aging unit, and an encoding unit for executing inverse 
conversion that is inverse to conversion performed by 
said decoding unit. 

51. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; 

a restoring unit for deleting a virus-infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk; and 

a saving unit for saving a virus-infected file that is 
registered in said infection management table unit and 
virus information concerning the file in an inexecutable 
area, and a reading unit for reading information saved 
in said inexecutable area under the condition that 
permission information for permitting access to said 
inexecutable area is given. 

* * * * * 
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